Intel Corporation

Mcafee, Inc.

Mingqiu Sun

Gopinatth Selvaraje

Vincent J Zimmer

Rajesh Poornachandran

Ned M Smith

Ravi L Sahita

Xiaoning Li

Mingwei Zhang

Suresh Srinivas

Chunhui Zhang

Ligang Wang

Yuyang Du

Xin Wang

Ravishankar Iyer

Stephan Jourdan

Konrad K Lai

Uttam K Sengupta

Yao Zu Dong

Ravi Rajwar

Prakash N Iyer

Ke Han

Dong Wang

Mohammad R Haghighat

Uma Srinivasan

Jian Sun

Stephen H Dohrmann

Yong Tong Chua

Andrzej Mialkowski

David M Durham

Yi Zhang

Kshitij Arun Doshi

Mohan J Kumar

Baiju V Patel

Michael Lemay

Andrew J Herdrich

Sara S Baghsorkhi

Robert Charles Swanson

Jr-Shian Tsai

Quinn Able Jacobson

Sven Schrecker

Eugene Gorbatov

Lei Shi

David A Koufaty

Vadim Sukhomlinov

Alexander Bachmutsky

Sarathy Jayakumar

Zhen Zhou

John S Howard

Jiewen Yao

Li Zhao

Lei Li

Ian M Steiner

Rameshkumar G Illikkal

Donald K Newell

Premanand Sakarda

Jeffrey D Chamberlain

Bin Yang

Nilesh K Jain

Tao Xu

Eric Dahlen

Amin Firoozshahian

Peggy J Irelan

Timothy E Abels

Jia Bao

Yeluri Raghuram

Dong-Yuan Chen

Dmitry Babokin

Anil Rao

Krishna Bhuyan

Leeor Peled

Richard Quinzio

Chao Xie

Areg Melik-Adamyan

Teck Joo Goh

Harshad S Sane

Yong Yao

Qiming Shi

Kumar Shiv

Anup Mohan

Fengqian Gao

Michael Prinke

Noah Zentzis

Jiu-Tao Nie

Chengrui Deng

Carl Lebsack

Bob Kasten

Mahesh Bhat

Wenyong Huang

Daoming Qiu

Haiwei Zhou

Sebastien Haezebrouck

Nicole Chalhoub

Technologies for untrusted code execution include a computing device having a processor with sandbox support. The computing device executes code included in a native domain in a non-privileged, native processor mode. The computing device may invoke a sandbox jump processor instruction during execution of the code in the native domain to enter a sandbox domain. The computing device executes code in the sandbox domain in a non-privileged, sandbox processor mode in response to invoking the sandbox jump instruction. While executing in the sandbox processor mode, the processor denies access to memory outside of the sandbox domain and may deny execution of one or more prohibited instructions. From the sandbox domain, the computing device may execute a sandbox exit instruction to exit the sandbox domain and resume execution in the native domain. The computing device may execute processor instructions to configure the sandbox domain. Other embodiments are described and claimed.

Technologies for untrusted code execution with processor sandbox support

Methods and apparatus to implement always-on context sensor hubs for processing multiple different types of data inputs are disclosed. An examples apparatus includes a first processor core to implement a host controller, and a second processor core to implement an offload engine. The host controller includes first logic to process sensor data associated with an electronic device when the electronic device is in a low power mode. The host controller is to offload a computational task associated with the sensor data to the offload engine. The offload engine includes second logic to execute the computational task.

Methods and apparatus to implement always-on context sensor hubs for processing multiple different types of data inputs

Methods, apparatus, systems and articles of manufacture to deduplicate duplicate memory in a cloud-computing environment are disclosed herein. An example apparatus to deduplicate duplicate memory comprises a parser to parse process information corresponding to instances of an application, a group generator to group process information into application groups based on the process information indicating instances corresponding to the same directory paths and application names, a data structure generator to generate a pair of binary search trees for an application group, and a merge controller to deduplicate duplicate memory contents detected in the application group.

Methods and apparatus to deduplicate duplicate memory in a cloud computing environment

Embodiments of systems, apparatuses and methods provide enhanced function as a service (FaaS) to users, e.g., computer developers and cloud service providers (CSPs). A computing system configured to provide such enhanced FaaS service include one or more controls architectural subsystems, software and orchestration subsystems, network and storage subsystems, and security subsystems. The computing system executes functions in response to events triggered by the users in an execution environment provided by the architectural subsystems, which represent an abstraction of execution management and shield the users from the burden of managing the execution. The software and orchestration subsystems allocate computing resources for the function execution by intelligently spinning up and down containers for function code with decreased instantiation latency and increased execution scalability while maintaining secured execution. Furthermore, the computing system enables customers to pay only when their code gets executed with a granular billing down to millisecond increments.

Function as a service (FaaS) system enhancements

Various embodiments are generally directed to techniques for supporting the distributed execution of a task routine among multiple secure controllers incorporated into multiple computing devices. An apparatus includes a first processor component and first secure controller of a first computing device, where the first secure controller includes: a selection component to select the first secure controller or a second secure controller of a second computing device to compile a task routine based on a comparison of required resources to compile the task routine and available resources of the first secure controller; and a compiling component to compile the task routine into a first version of compiled routine for execution within the first secure controller by the first processor component and a second version for execution within the second secure controller by a second processor component in response to selection of the first secure controller. Other embodiments are described and claimed.

Techniques for distributed operation of secure controllers

A method and apparatus for cooperative scheduling of virtual machines. An exemplary method includes maintaining a CPU mask by a virtual machine manager, wherein the CPU mask comprises a real-time availability of each of a plurality of physical CPUs (PCPUs). A virtual machine (VM) is allowed to read the CPU mask.

Cooperative scheduling of virtual machines

A virtual machine migration controller may perform the live migration of a plurality of virtual machines from a first physical host system to a second physical host system. The virtual machine migration controller may determine a memory page dirty rate for each of a plurality of virtual machines. The virtual machine migration controller may additionally identify virtual machines that share memory pages and/or map to different memory pages having, at least in part, identical data or information. The virtual machine migration controller may group virtual machines demonstrating commonality among mapped memory pages. The virtual machine migration controller may determine a projected migration time based on the dirtying rate, the commonality of memory pages, and the available bandwidth. The virtual machine migration controller orders and transfers virtual machine groups based on the projected migration time.

Virtual machine batch live migration

Apparatuses, methods and storage medium associated with installing and executing an application program on an embedded system are described herein. In embodiments, an embedded system may include an application management program and an application execution program to install an application program onto the embedded system. The application management program is to verify metadata associated with the application program, in response to a first request to install the application program on the embedded system; and the application execution program is to verify the application program, in response to a second request, subsequent to the first request, to verify the application program. Other aspects and embodiments may be described and/or claimed.

Embedded system application installation and execution method and apparatus

Various systems and methods for virtual CPU consolidation to avoid physical CPU contention between virtual machines are described herein. A processor system that includes multiple physical processors (PCPUs) includes a first virtual machine (VM) that includes multiple first virtual processors (VCPUs); a second VM that includes multiple second VCPUs; and a virtual machine monitor (VMM) to map individual ones of the first VCPUs to run on at least one of, individual PCPUs of a first subset of the PCPUs and individual PCPUs of a set of PCPUs that includes the first subset of the PCPUs and a second subset of the PCPUs, based at least in part upon compute capacity of the first subset of the PCPUs to run the first VCPUs, and to map individual ones of the second VCPUs to run on individual ones of the second subset of the PCPUs.

Virtual CPU consolidation to avoid physical CPU contention between virtual machines

An automated method for distributed and redundant firmware evaluation involves using a first interface that is provided by system firmware of a client device to obtain, at an evaluation server, a first firmware resource table (FRT) from the client device. The evaluation server also uses a second interface that is provided by a component of the client device other than the system firmware to obtain a second FRT from the client device. The evaluation server automatically uses the first and second FRTs to identify a trustworthy FRT among the first and second FRTs. The evaluation server automatically uses the trustworthy FRT to determine whether the client device should be updated. For instance, the evaluation server may automatically use the trustworthy FRT to determine whether firmware in the client device should be updated. Other embodiments are described and claimed.

Distributed and redundant firmware evaluation

Technologies for configuring a launch enclave include a computing device having a processor with secure enclave support. A trusted execution environment (TEE) of the computing device stores a launch enclave hash in a launch enclave hash table in secure storage and provisions the launch enclave hash to platform firmware at runtime. The TEE may receive the launch enclave hash via trusted I/O. The platform firmware sets a configure enclave launch bit and resets the computing device. On reset, the TEE determines whether the launch enclave hash is allowed for launch. The TEE may evaluate one or more launch configuration policies and may select a launch enclave hash based on the launch configuration policies. If allowed, the platform firmware writes the launch enclave hash to a model-specific register of the processor, and the launch enclave may be loaded and verified with the launch enclave hash. Other embodiments are described and claimed.

Technologies for provisioning and managing secure launch enclave with platform firmware

Growing community of inventors

Beaverton, OR, United States of America

Mingqiu Sun